Who is responsible for the processing?

Universal-Investment-Luxembourg S.A.
15, rue de Flaxweiler
6776 Grevenmacher
Luxembourg
E-Mail: Datenschutzbeauftragter-UIL@universal-investment.com
 
What are the contact details of our data protection officer?
DURY Consult GmbH
Obertorstrasse 1
66111 Saarbruecken
Deutschland
E-Mail: Datenschutzbeauftragter-UIL@universal-investment.com

For what purposes and on what legal basis is your data processed?

Depending on the business contact we have with you and/or the company you work for, we process your data for the following purposes, based on the following legal bases:
• for the fulfilment of contractual obligations or taking steps prior to entering into a contract, including the enforcement of contractual rights, processing of claims, participation in events, etc. This is justified pursuant to Art. 6 (1) (b) General Data Protection Regulation (GDPR).
• to comply with legal obligations, e.g. tax, accounting or administrative obligations. This is justified in accordance with Art. 6 (1) (c) GDPR.
• to safeguard legitimate interests in accordance with Art. 6 (1) (f) GDPR, which we have weighed up against your interests, rights and freedoms:

- Managing, maintaining and assessing the business relationship with you or the company you work for
- Communication with you, processing of enquiries and orders, naming of contact persons
- Information and marketing purposes in the sense of maintaining contacts, providing news and information, organising events, market research and analysis. 
- Improvement of our services
- Organising, securing and improving our business processes
- Prevention of legal offences

If the provision of personal data is required by law or contract or is necessary for the conclusion of a contract, you are obliged to provide the personal related data. For example, we require certain contact details for a contractual relationship. If you do not provide your personal related data, we may not be able to enter into the contractual relationship.

What categories of data do we process?

Depending on the business contact with you and/or with the company you work for, we process the following data:
• First and last name, title, gender, form of address
• Company, function, assignment, details of the business relationship
• Profession, speciality, qualifications
• Contact and address details (including address, e-mail address, telephone number, fax number)
• Enquiries, e-mails, agreements, meeting notes
• Order, invoice and payment data
• Bank and credit card details
• Participant data (seminars, events)
• User data
We usually collect the data directly from you. In certain cases, we may receive data from other sources, such as competent authorities, credit agencies or service providers as part of a contract. Furthermore, in certain cases we may use data from publicly accessible sources (e.g. associations, commercial registers, websites, social media, print media).

To which categories of recipients will your data be passed on? 

The following recipients may receive personal data from us to the extent necessary:

• For the aforementioned legitimate purposes, your personal data may be disclosed to authorised representatives and external service providers who process the data themselves as controllers (e.g. tax consultants, auditors, lawyers, insurers, banks, event organisers, etc.).
• For the aforementioned lawful purposes, we may also disclose your personal data to processors who process the data only in accordance with our instructions and on the basis of a contract for commissioned processing pursuant to Art. 28 GDPR. These processors may be authorised representatives or external service providers (e.g. printing and dispatch, IT support, hosting, maintenance, disposal), but also intermediaries, consultants or agencies that are responsible for communication or organise events for us.
• In addition, your personal data may also be passed on to authorities, courts, parties to a legal dispute or their authorised representatives if we are obliged to do so on the basis of applicable law, applicable regulations, legal proceedings or enforceable official orders.

In certain cases, it may be necessary to transfer data to countries outside the EU or EEA. The transfer takes place on the basis of an adequacy decision by the EU Commission or subject to suitable guarantees, which we will make available to you on request.

How long will your data be stored? 

Your data will be deleted when the purpose for which it was collected no longer applies. This means that we store the data for as long as we are legally obliged to store the data. If there is no statutory retention period, we store the data for the duration of the contractual relationship with you or with the company you work for. If we process the data to safeguard legitimate interests, it will be deleted as soon as the legitimate interest no longer exists. 

What rights do you have with regard to your personal data? 

You have the following rights towards us with regard to your personal data. Please note that some of these rights are subject to certain conditions.

Right to information
You have the right to request confirmation as to whether we are processing your personal data. If this is the case, you have a right of access to the information specified in Art. 15 (1) GDPR, provided that the rights and freedoms of other persons are not affected. We will also be happy to provide you with a copy of the data.

Right to rectification
In accordance with Art. 16 GDPR, you have the right to have any incorrect personal data stored by us (e.g. name, address) corrected at any time. You can also request the completion of the data stored by us at any time. A corresponding adjustment will be made immediately.

Right to erasure
In accordance with Art. 17 (1) GDPR, you have the right to request that we erase the personal data collected about you if
• the data is no longer necessary;
• the legal basis for processing no longer applies due to the withdrawal of your consent;
• you have objected to the processing and there are no legitimate grounds for the processing;
• your data is processed unlawfully;
• a legal obligation requires this or a collection in accordance with Art. 8 para. 1 GDPR has taken place.

Pursuant to Art. 17 (3) GDPR, there is no right to erasure if
• the processing is necessary for exercising the right of freedom of expression and information;
• your data has been collected on the basis of a legal obligation;
• the processing is necessary for reasons of public interest;
• the data is required for the establishment, exercise or defence of legal claims.

Right to restriction of processing

In accordance with Art. 18 (1) GDPR, you have the right to request the restriction of the processing of your personal data in individual cases. This is the case if
• the accuracy of the personal data is contested by you;
• the processing is unlawful and you do not consent to erasure;
• the data are no longer needed for the purposes of processing, but are required by you for the establishment, exercise or defence of legal claims;
• an objection to the processing pursuant to Art. 21 (1) GDPR has been lodged and it is still unclear which interests prevail.

Right of withdrawal
If you have given us your express consent to the processing of your personal data (Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR), you can withdraw this consent at any time. Please note that the lawfulness of the processing carried out on the basis of the consent until the withdrawal is not affected by the withdrawal.

Right to object
In accordance with Art. 21 GDPR, you have the right to object at any time to processing of personal data concerning you that has been collected on the basis of Art. 6 para. 1 lit. f (in the context of a legitimate interest). You only have this right if there are special circumstances that speak against the storage and processing. Furthermore, you have the right to object at any time to the processing of personal data concerning you for the purpose of direct marketing.

Right to data portability
In accordance with Art. 20 GDPR, you have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format, provided that the data fulfil the following conditions:
• Data collected on the basis of express consent pursuant to Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR, or
• data that we have received from you in accordance with Art. 6 para. 1 lit. b GDPR as part of existing contracts, and
• data that has been processed by automated means.

How do you exercise your rights?
You can exercise your rights at any time by using the following contact details:
DURY Consult GmbH
Obertorstrasse 1
66111 Saarbruecken
Deutschland
E-Mail: Datenschutzbeauftragter-UIL@universal-investment.com

Right to lodge a complaint with the supervisory authority
You also have the right to lodge a complaint with a supervisory authority for data protection. The supervisory authority responsible for us is
Commission nationale pour la protection des données
15, Boulevard du Jazz
4370 Belvaux
Luxembourg
Tel.: +352 261060-1
https://cnpd.public.lu/de/support/contact/contact-prive.html